Anti-facial recognition tool Fawkes changes your photos just enough to stump Microsoft and Amazon

Software from University of Chicago researchers is designed to help internet users avoid being tracked online
Invasive facial recognition systems gathering facial data from social media threaten personal privacy worldwide

Facial recognition

Xinmei Shen

Published: 7:59pm, 24 Jul 2020

Why you can trust SCMP

In the age of facial recognition, it’s not unreasonable for some to fear that bad actors could use this technology to track them. So researchers at the University of Chicago have come up with a tool to try to fix this.

Fawkes is a computer program that makes small, pixel-level changes to your pictures before you upload them to social media. And yes, the name comes from would-be assassin Guy Fawkes, best known today as the face of the V for Vendetta mask.

The changes Fawkes makes to images are so small that altered photos look almost the same to human eyes. But the changes are also significant enough to prevent third-party facial recognition from identifying the subject. The researchers hope this can help internet users protect their online privacy as it becomes easier for anyone to train effective facial recognition models.

In their paper on the software, the researchers say Fawkes “provides 95+% protection against user recognition”. They also say Fawkes tested 100% effective against some of the most advanced facial recognition systems, including Microsoft Azure Face, Amazon Rekognition and Face++ from Chinese company Megvii.

“In today’s world where big tech is becoming ubiquitous in our lives, it is clear that we cannot trust large companies to protect our privacy interests,” said Ben Zhao, professor of computer science at the University of Chicago and one of the researchers who developed Fawkes.

But is facial recognition really such a threat? The researchers point to the American facial recognition company Clearview AI as an example of why you might want to use Fawkes. Clearview’s software scrapes images form popular platforms like YouTube and Facebook without the knowledge or consent of the owners. The company’s main clients are now law enforcement agencies since it stopped selling the software to private companies earlier this year.

The researchers note that Fawkes isn’t a response to Clearview specifically. Development on Fawkes started before a New York Times story shed light on Clearview’s practices in January, they said.

A facial recognition demonstration at the Horizon Robotics exhibit at during CES 2019 in Las Vegas on January 10, 2019. Photo: AFP

Zhao told us that he and his research group have always been interested in protecting personal privacy. His previous project was a bracelet that silently jams nearby microphones by emitting ultrasonic signals. He said the idea was prompted by privacy concerns over his Alexa-enabled Amazon Echo smart speaker at home.

As facial recognition becomes more pervasive in people’s lives, researchers around the world have been trying to come up with viable ways to thwart it. Some software can alter key features on a person’s face. Another trick is wearing specific accessories like hats and glasses or wearing clothing with specific patterns that stump the algorithms.

Having to change what you wear is isn’t very convenient in day-to-day life, though. And some of these solutions are only designed to confuse a few specific facial recognition systems. The University of Chicago researchers say Fawkes is the first practical tool for average internet users to fight facial recognition.

The source code for Fawkes can be found on GitHub, and the researchers also offer binary files for Mac, Windows and Linux that are free to download. If you’re hoping for a mobile app, though, you’re out of luck. The team says there are no plans for one because the computing power required for Fawkes is challenging for smartphones.

Zhao also said he doesn’t believe in releasing the software commercially.

“Privacy should not have a price,” Zhao said. “Thus we do not have plans to commercialise Fawkes. We might explore copyright or patents simply to make sure that Fawkes is not commercialised by the wrong people.”

An ideal way to use Fawkes, according to Zhao, would be for companies like those running social media platforms to offer it themselves. Then user photos could be modified when they’re uploaded, automatically protecting millions of users.

Post